GermanyBürgerliches Gesetzbuch (BGB), Section 327f Updates, Including Security Updates, for Digital Products
In force since .
A product security requirements rule binding public and private bodies.
- Private right of action
- No
- Obligation class
- Security
As of .
What it requires
- If you are a trader supplying a digital product, meaning digital content or a digital service such as software or an app, to a consumer under a contract, Section 327f binds you.
- Provide the consumer, during the relevant period, with the updates needed to keep the digital product in conformity with the contract, including security updates, and inform the consumer about them (Section 327f(1)).
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST CSF 2.0
- PR.PS-02Software is maintained, replaced, and removed commensurate with risk
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- For how long must a trader supply security updates for a digital product sold in a one-time supply, when Section 327f(1) sentence 3 number 2 of the BGB sets the period the consumer 'aufgrund der Art und des Zwecks des digitalen Produkts ... erwarten kann' (can expect from the nature and purpose of the digital product)?
What this law does
Section 327f(1) of the Bürgerliches Gesetzbuch (BGB) requires a trader (Unternehmer) supplying a digital product to a consumer to ensure that the consumer is provided, during the relevant period, with the updates needed to keep the product in conformity with the contract, and is informed about them. The necessary updates include security updates.
The relevant period is the supply period for a contract on the continuous supply of a digital product, and otherwise the period the consumer can expect given the nature and purpose of the product and the circumstances and type of contract.
Under Section 327f(2), the trader is not liable for a defect that is due solely to the consumer's failure to install a provided update within a reasonable time, if the trader informed the consumer of the update and of the consequences of not installing it and the failure was not due to defective installation instructions.
The provision applies to consumer contracts on a digital product concluded from and, under Article 229 Section 57 of the Introductory Act to the BGB, to earlier contracts where supply takes place from that date.
When LexLint raises it
When your app profile says your app distributes a software product or ships a mobile app.